CVE-2026-11565: WordPress File Manager Info Disclosure Flaw

CVE-2026-11565 Overview

CVE-2026-11565 is a broken access control vulnerability in the Advanced File Manager WordPress plugin versions prior to 5.4.13. The plugin fails to perform capability checks in several file management AJAX actions. Any authenticated user with file-manager access granted by an administrator, including low-privilege roles such as Subscriber, can invoke these actions. Attackers can read arbitrary files on the server, including sensitive configuration files, and overwrite existing non-PHP files. The flaw can be chained to compromise administrator accounts and take control of the entire WordPress site.

Critical Impact
Low-privileged users granted file-manager access can read sensitive server files and overwrite site assets, enabling full site takeover.

Affected Products

Advanced File Manager WordPress plugin versions before 5.4.13
WordPress sites where an administrator has granted file-manager access to non-administrator roles
Subscriber, Contributor, Author, and Editor accounts with plugin-granted file-manager access

Discovery Timeline

2026-08-19 - CVE-2026-11565 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-11565

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw in the Advanced File Manager plugin's AJAX endpoints. Several file management AJAX actions do not verify the caller's WordPress capability before executing privileged file operations. The plugin relies on an administrator-controlled setting that grants file-manager access to specific roles. Once granted, even a Subscriber can invoke file read and file write actions that should be restricted to administrators.

Successful exploitation yields two primary outcomes. First, attackers can read arbitrary files on the server file system, including wp-config.php, which contains database credentials and authentication salts. Second, attackers can overwrite existing non-PHP files such as JavaScript assets, theme templates, and configuration files. Overwriting a JavaScript file loaded in the administrator dashboard enables cross-site scripting against administrators and full account compromise.

Root Cause

The root cause is the absence of current_user_can() checks within the vulnerable AJAX handlers. The plugin conflates "has plugin access" with "authorized for the requested operation" and does not enforce granular capability validation per action. See the WPScan Vulnerability Advisory for technical details.

Attack Vector

Exploitation requires an authenticated session on the target WordPress site with any role that the administrator has granted file-manager access. The attacker submits crafted requests to the vulnerable AJAX endpoints over HTTP. No user interaction from administrators is required to read files. Overwriting a JavaScript asset loaded by administrators triggers stored XSS on the next admin page load, escalating to administrator privileges.

No public proof-of-concept code has been verified for this CVE. Refer to the WPScan advisory linked above for exploitation specifics.

Detection Methods for CVE-2026-11565

Indicators of Compromise

Unexpected POST requests to Advanced File Manager AJAX actions from non-administrator user sessions
Modifications to JavaScript, CSS, or theme template files with timestamps that do not correlate with legitimate admin activity
Access log entries showing low-privileged users invoking admin-ajax.php with file-manager action parameters
New or modified administrator accounts following file overwrite activity

Detection Strategies

Audit WordPress user role assignments and identify accounts granted Advanced File Manager access outside the administrator role
Correlate admin-ajax.php requests with user roles to flag file-manager actions invoked by Subscriber, Contributor, or Author accounts
Monitor file integrity for the wp-content directory, focusing on JavaScript and theme files
Alert on read access patterns targeting wp-config.php or other sensitive configuration files

Monitoring Recommendations

Enable WordPress activity logging with a plugin that records AJAX action invocations and the acting user role
Ship web server access logs to a centralized logging platform and build queries for Advanced File Manager AJAX endpoints
Deploy file integrity monitoring across the WordPress document root to detect unauthorized overwrites
Review recent administrator logins and password changes for accounts that could have been hijacked via stored XSS

How to Mitigate CVE-2026-11565

Immediate Actions Required

Update the Advanced File Manager plugin to version 5.4.13 or later on all WordPress installations
Revoke file-manager access from all non-administrator roles until the patch is applied
Rotate WordPress secrets in wp-config.php and database credentials if unauthorized file reads are suspected
Audit administrator accounts for unauthorized additions or privilege changes

Patch Information

The vendor has released version 5.4.13 of the Advanced File Manager plugin, which adds capability checks to the affected AJAX actions. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. See the WPScan Vulnerability Advisory for advisory details.

Workarounds

Restrict Advanced File Manager access exclusively to the administrator role via the plugin's role configuration
Deactivate the Advanced File Manager plugin until the update to 5.4.13 can be scheduled
Enforce web application firewall rules that block admin-ajax.php requests to file-manager actions from non-administrator sessions
Apply file system permissions that prevent the web server user from overwriting theme and plugin JavaScript assets in production

bash

# Update Advanced File Manager via WP-CLI
wp plugin update advanced-file-manager --version=5.4.13

# Verify installed version
wp plugin get advanced-file-manager --field=version

# Temporarily deactivate the plugin if patching is delayed
wp plugin deactivate advanced-file-manager